Skip to content
FixSecurityHeadersScan a site

How to add X-Frame-Options on IIS

Last updated · Reviewed by a CISSP-certified security practitioner

To add X-Frame-Options on IIS, set the header in web.config with the value DENY. Prevents your site being embedded in iframes (clickjacking). Save web.config; IIS applies it on the next request. Recycle the app pool if needed. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does X-Frame-Options do?

X-Frame-Options (or the modern CSP frame-ancestors) tells browsers whether other sites may put your pages inside an iframe.

Risk if missing: Attackers can overlay your page invisibly and trick users into clicking buttons (clickjacking) — e.g. changing settings or confirming payments.

What is the IIS configuration?

Add this to web.config:

web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="X-Frame-Options" value="DENY" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

How do I add it step by step?

  1. Open web.config.
  2. Paste the X-Frame-Options configuration shown below.
  3. Save web.config; IIS applies it on the next request. Recycle the app pool if needed.
  4. Run curl -I https://yourdomain.com and look for the x-frame-options line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "x-frame-options"
# expected:
# x-frame-options: DENY

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Use SAMEORIGIN if your own site frames its pages.
  • ALLOW-FROM is obsolete; use CSP frame-ancestors for allow-lists.
  • If CSP frame-ancestors is present, modern browsers ignore X-Frame-Options.
  • Headers in web.config apply to every response from that site.
  • Removing the Server header requires removeServerHeader (IIS 10+) or URL Rewrite.

Quick reference

HeaderX-Frame-Options
Recommended valueDENY
StackIIS
Whereweb.config
ComplianceOWASP ASVS V14.4.7, NIST 800-171 3.13.1, CMMC SC.L2-3.13.1

FAQ

What value should I use for X-Frame-Options?

A safe default is DENY. Use SAMEORIGIN if your own site frames its pages.

Why isn't X-Frame-Options showing up on IIS?

Headers in web.config apply to every response from that site. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does X-Frame-Options affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference X-Frame-Options?

OWASP ASVS V14.4.7, NIST 800-171 3.13.1, CMMC SC.L2-3.13.1.

Related guides